Re: [TLS] Questions about TLS Server Name Indication extension

[Wan-Teh Chang <wtc at google.com>]

On Wed, Oct 28, 2009 at 10:35 AM, Nelson B Bolyard <nelson at bolyard.me> wrote:
>
> In the context of a physical server acting as multiple virtual server,
> is the space of session IDs coming from that server a single space that
> encompasses all the sessions for all the virtual servers served by that
> physical server?  Or does each virtual server have its own separate space?
>
> If each virtual server has its own separate session ID space, then when
> attempting to "resume" or "restart" a TLS session, the client hello MUST
> bear an SNI extension to inform the physical server which virtual server's
> session ID space contains the given session ID, and each virtual server
> potentially has its own separate session store/cache.

When attempting to resume a TLS session, the client hello must
bear an SNI extension for another reason: it's not guaranteed that
the server will accept the request to resume the session.  This issue
is discussed in Section 2.3 of the TLS extensions RFC 3546.  (The
RFC uses SHOULD instead of MUST.)

> OTOH, if there is a single session ID space for the entire physical server
> covering all the virtual servers, then each cached session must record and
> identify the virtual server with which it is associated.

If a client certificate is used in the session, it seems that the
session should only be associated with the virtual server that
authenticated the client certificate, as opposed to the entire
physical server covering all the virtual servers.  I guess there
are multiple ways to accomplish that.

Wan-Teh